How your archive stays private

A closed archive, by invitation

Each archive belongs to one family. There is no public sign-up: an account exists only for someone a family's owner or admin has invited, and an invitation works once. Nothing in an archive is public.

• Owners, admins, editors, contributors and viewers each do what their role allows: contributors propose changes, editors make them, admins review changes and manage members, and owners decide what touches the whole family, such as AI assistants and backups.
• An owner or admin can limit any member to one branch, and keep living people's details, DNA, or photos and files from them.
• Every change is kept with who made it and when, and the owners and admins can read the activity log.

Encrypted with your family's own key

• Every family has its own key. Photos, scans, documents, videos, their previews and DNA files are encrypted with it (AES-256-GCM) as they are uploaded, and no unencrypted copy is kept.
• The family's key is itself encrypted with the service's master key, which is kept apart from the database.
• The tree, with its names, dates, places and notes, is kept in a database that walls each family's records off from every other family's (row-level security).
• In each night's backup, every family's part is sealed with that family's own key.
• If the owners keep the originals in their own Amazon S3 or compatible bucket, they are stored there encrypted, so the storage company cannot read them.

Who else can see it

• The people who run the service look after the server. Inside the app, they can open a family's archive only with time-limited access, for a stated reason; it is recorded, and every owner of the family is emailed when it starts. Even then, they never see DNA.
• AI assistants, such as Claude, can read a family's archive only if its owners allow it. An assistant sees only what its member can see, and what it reads goes to the company behind it. It never gets original files or raw DNA files.
• Place names, and only the names, are looked up on OpenStreetMap to put them on the map. Your browser loads the map pictures from OpenStreetMap itself.

Living people

• Anyone marked living, or with no death or burial recorded and born or baptised less than 110 years ago, counts as possibly living.
• Members see living people as their role allows. An owner or admin can keep living people's details from any member, who then sees each of them only as “Living” and a surname, without their photos or DNA.
• A link to one branch shows the family book to someone without an account, for 30 days at most, and can be revoked at once. It never shows living people's details, nor any photos.
• A GEDCOM export made for sharing keeps living people only as “Living” and a surname, without dates, places, notes or sources.
• If the owners allow AI assistants without living details, an assistant sees only the names, relationships and birth years of the living.

DNA

• Raw files from 23andMe, AncestryDNA, MyHeritage and FamilyTreeDNA are read on the service's own server. Anyone can add their own kit; only the owners and admins add kits for others. Each kit records who consented and when: the person, a guardian, the next of kin, or someone with their permission.
• The raw file is encrypted with the family's key and compared only with the same family's kits. It is never sent to another service. A family can choose to keep only the readings needed for comparing, not the file itself.
• A kit is seen by its person and by the family's owners and admins. Mark it private, and only the person and the owners see it. A match shows to whoever sees both kits, and to the person of either kit when the other is not private.
• The service's administrators never see DNA, even with time-limited access, and AI assistants never get raw files.
• Deleting a kit deletes its files, its matches and everything worked out from it, at once.
• DNA worked out for a parent who never tested is kept only if an owner asks and records whose consent it is. Only the owners and that person see it, and it goes as soon as any kit it was made from is deleted.

Taking everything with you

• Import a GEDCOM 7 or 5.5.1 file from any genealogy program. Export the whole tree as GEDCOM 7, or as 5.5.1 for older programs; what Ancestral Nest does not use itself, such as another program's own IDs, is kept and written back out.
• Owners and admins can download the whole archive as one ZIP: the tree in both GEDCOM versions and every original photo, video and document.
• Owners can have that archive sent every night to an S3-compatible bucket of their own (Amazon S3, Cloudflare R2, Backblaze B2, Wasabi or MinIO). That copy is readable, so keep the bucket private.

Deleting

• A deleted photo or file waits in the trash for 30 days, where the owners and admins can restore it; then it is destroyed.
• An owner can delete the whole family. Everyone loses access at once, and for 30 days the service can still restore it, in case it was a mistake. After that, its tree, files and keys are destroyed, in the service's backups too.
• Copies you downloaded, or sent to your own storage, stay yours to keep or delete.

No trackers

• ancestralnest.com has no cookies, no scripts, no analytics and no advertising. Its fonts and pictures are served from here, so a visit tells no one else.
• The app uses only the cookies it needs to keep you signed in and protect your session. It has no analytics and no advertising.

Questions

Write to [email protected].